Updated December 23, 2024
In response to some states’ efforts to obtain protected health information (PHI) from patients seeking reproductive health care, the Biden administration has implemented new HIPAA rules restricting access to that information if it is to be used to punish health care providers and patients. The rules contain several key components that require your attention.
The New Rules and a Broad Definition of Reproductive Health Care
Starting on December 23, 2024, health care providers may not use or disclose protected health information (PHI) for any of the following purposes:
• To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care;
• To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; or
• To identify any person for the above purposes.
“Reproductive health care” is defined broadly and means health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. The U.S. Department of Health and Human Services (HHS) has provided a non-exhaustive list of what it considers reproductive health care, which includes:
• Contraception (including emergency contraception).
• Preconception screening and counseling.
• Managing pregnancy and pregnancy-related conditions (for example, pregnancy screening, prenatal care, miscarriage management, preeclampsia treatment, hypertension during pregnancy, gestational diabetes, molar or ectopic pregnancy, and pregnancy termination).
• Fertility and infertility diagnosis and treatment, including assisted reproductive technology and its components (for example, in vitro fertilization (IVF)).
• Diagnosis and treatment of conditions affecting the reproductive system (for example, perimenopause, menopause, endometriosis, adenomyosis).
• Other types of care, services, and supplies used for diagnosing and treating conditions related to the reproductive system (for example, mammography, pregnancy-related nutrition services, and postpartum care products).
Attestation Requirement
When health care providers receive a request for PHI potentially related to reproductive health care, the new rules require that they obtain a signed attestation from the requesting party that the use or disclosure is not for a prohibited purpose. The attestation requirement applies when the request is for PHI for any of the following reasons:
• Health oversight activities (e.g., requests from HHS or OHA)
• Judicial and administrative proceedings (e.g., subpoenas from an attorney in a civil case)
• Law enforcement purposes (e.g., subpoenas from a district attorney or requests by a police officer)
• Disclosures to coroners and medical examiners
HHS has created a model attestation that can be accessed here.
Notice of Privacy Practices Update
By February 16, 2026, providers must update their HIPAA Notice of Privacy Practices to describe the additional privacy safeguards for reproductive health care.
Challenges and Next Steps
The state of Texas has filed a lawsuit challenging the enforceability of the new rules. The court has not issued a decision in that case, but it is possible that the court could halt or strike down the rules after December 23. In addition, there is uncertainty about whether and how the incoming presidential administration will enforce the new rules.
In the meantime, health care providers should:
• Assess whether they collect PHI related to reproductive health care.
• Consider updating their HIPAA compliance policies and procedures to align with the new rules.
• Use HHS’s model attestation for compliance with the new rules when there is a request for one of the reasons specified above.
Please feel free to contact us with any questions.
This summary provides general information and should not be construed as legal advice or a legal opinion on any specific facts or circumstances. If you have specific legal questions, you are urged to consult with your attorney concerning your own situation.